The vulnerability CVE-2025-52809 in John Russell National Weather Service Alerts is caused by improper validation or control of filenames used in PHP include or require statements. This flaw allows an attacker to perform Local File Inclusion (LFI), which can lead to arbitrary file disclosure or code execution depending on the context. The affected versions include all releases up to and including 1.3.5. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, execution of arbitrary code, and potentially full system compromise. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor for updates from John Russell or the National Weather Service Alerts project. Until a fix is available, consider restricting access to the affected application and applying web application firewall rules to detect and block suspicious include/require requests if feasible.